refactor: rename root directories to tasks and runner

.github/workflows/README.md

@@ -39,6 +39,6 @@ cleanup or cancellation does not undo GitHub operations that already succeeded.
 
 Add another reusable workflow only when the capability has a distinct trigger,
 permission, or trust contract. Keep review and merge separate, and keep
-repository-specific task behavior in [workloads/](../../workloads/) rather than
+repository-specific task behavior in [tasks/](../../tasks/) rather than
 growing a single workflow with general-purpose image, policy, provider, or
 command inputs.

.github/workflows/ci.yml

@@ -37,7 +37,7 @@ jobs:
       - uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
-      - run: CGO_ENABLED=0 go build -o harness ./workflow
+      - run: CGO_ENABLED=0 go build -o harness ./runner
       - run: ./test/suite/run.sh
 
   lint:

.github/workflows/integration.yml

@@ -22,7 +22,7 @@ jobs:
 
       - name: Run local integration
         run: |
-          CGO_ENABLED=0 go build -ldflags '-s -w -X main.version=ci' -o harness ./workflow
+          CGO_ENABLED=0 go build -ldflags '-s -w -X main.version=ci' -o harness ./runner
           ./test/test-flow.sh local-container
         env:
           TEST_LOG_FILE: /tmp/test-logs/test-flow-local.log

.github/workflows/pr-review-reusable.yml

@@ -59,7 +59,7 @@ jobs:
           path: harness
           persist-credentials: false
       - name: Install default review skill
-        run: install -D -m 0644 harness/workloads/github-pr-reviewer/workflow/skills/pr-review/SKILL.md harness/skills/pr-review/SKILL.md
+        run: install -D -m 0644 harness/tasks/github-pr-reviewer/workflow/skills/pr-review/SKILL.md harness/skills/pr-review/SKILL.md
       - name: Install caller skill
         if: inputs.skill-path != ''
         env:

.github/workflows/upstream-canary.yml

@@ -30,7 +30,7 @@ jobs:
           openshell --help
       - name: Run credential-free local lifecycle
         run: |
-          CGO_ENABLED=0 go build -ldflags '-s -w -X main.version=upstream-canary' -o harness ./workflow
+          CGO_ENABLED=0 go build -ldflags '-s -w -X main.version=upstream-canary' -o harness ./runner
           ./test/test-flow.sh local-container --ci
         env:
           TEST_LOG_FILE: /tmp/test-logs/upstream-canary.log

.gitignore

@@ -34,7 +34,7 @@ reviewer.yaml
 skills-lock.json
 
 # Repository-owned workload documents are not scratch configs.
-!workloads/**/harness.yaml
+!tasks/**/harness.yaml
 
 # Local audit working notes
 docs/audit-*.md

.goreleaser.yaml

@@ -6,7 +6,7 @@ project_name: harness
 
 builds:
   - binary: harness
-    main: ./workflow
+    main: ./runner
     env:
       - CGO_ENABLED=0
     goos:

Makefile

@@ -36,7 +36,7 @@ all: cli dev-sandbox
 
 ## Build the harness CLI binary
 cli:
-	CGO_ENABLED=0 go build -ldflags '$(LDFLAGS)' -o harness ./workflow
+	CGO_ENABLED=0 go build -ldflags '$(LDFLAGS)' -o harness ./runner
 	@echo "Built: ./harness ($(VERSION))"
 
 ## Install/refresh the pinned OpenShell CLI + gateway (reads .openshell-version)

README.md

@@ -23,12 +23,12 @@ temporary workspace.
 
 | Task bundle | Allowed GitHub operation | Integration status |
 |---|---|---|
-| [PR reviewer](workloads/github-pr-reviewer/) | Read the selected PR and post inline comments to it | Used by the reusable review workflow |
-| [PR merger](workloads/github-pr-merger/) | Read the selected PR and head checks, then request a merge under a separate approval and credential contract | Opt-in bundle; consumer enablement and live validation are separate steps |
+| [PR reviewer](tasks/github-pr-reviewer/) | Read the selected PR and post inline comments to it | Used by the reusable review workflow |
+| [PR merger](tasks/github-pr-merger/) | Read the selected PR and head checks, then request a merge under a separate approval and credential contract | Opt-in bundle; consumer enablement and live validation are separate steps |
 
 For review, trusted setup obtains a repository-scoped GitHub App installation
 token with `Contents: read` and `Pull requests: write`. The
-[OpenShell REST policy](workloads/github-pr-reviewer/openshell/policy.yaml)
+[OpenShell REST policy](tasks/github-pr-reviewer/openshell/policy.yaml)
 further restricts sandbox requests to the chosen PR's read endpoints and inline
 comment `POST` endpoint. The agent uses `gh api`; OpenShell's network proxy
 enforces the permitted host, HTTP methods, and paths.
@@ -47,7 +47,7 @@ and a failed or cancelled run may already have performed permitted actions.
 
 `harness-openshell` packages the integration around OpenShell. The `harness`
 CLI is its generic composition and sandbox lifecycle component. A **task
-bundle**, called a workload in this repository, combines agent instructions,
+bundle** combines agent instructions,
 an image, native OpenShell policy, provider references, and payloads. A
 **harness workflow document** declares a run; a **GitHub Actions workflow**
 supplies its CI trigger and trusted host setup.
@@ -118,7 +118,7 @@ data. The `ai-review` label is explicit opt-in. See
 | [Reusable workflow](.github/workflows/pr-review-reusable.yml) | Trusted checkout, job permissions, App token, and setup/execution steps |
 | [`setup-openshell`](.github/actions/setup-openshell/action.yml) | Invoke the installer for the pinned OpenShell CLI release and wait for gateway readiness |
 | [`scripts/pr-review.sh`](scripts/pr-review.sh) | Stage the diff, create a temporary workspace and providers, configure inference, render the PR policy, and invoke the CLI |
-| [`harness` CLI](workflow/) | Compose the task and manage its sandbox lifecycle |
+| [`harness` CLI](runner/) | Compose the task and manage its sandbox lifecycle |
 
 The current reviewer uses a local gateway on the CI runner. The CLI's direct
 managed-gateway connection is implemented, but the reusable reviewer has not
@@ -159,8 +159,8 @@ openshell gateway add https://127.0.0.1:17670 --local --name openshell
 openshell gateway select openshell
 ```
 
-Choose a task from [workloads/](workloads/) and prepare its documented inputs.
-The [PR reviewer](workloads/github-pr-reviewer/) includes the native OpenShell
+Choose a task from [tasks/](tasks/) and prepare its documented inputs.
+The [PR reviewer](tasks/github-pr-reviewer/) includes the native OpenShell
 inputs; [docs/ci.md](docs/ci.md#label-driven-pr-review) gives the trusted wrapper
 commands for running it locally. For your own prepared workflow document:
 
@@ -183,11 +183,11 @@ agent, collects declared output files, and deletes the sandbox.
 | Component | Owns |
 |---|---|
 | Consuming repository | Opt-in triggers, trusted task inputs, review criteria, and approval rules |
-| [.github/workflows/](.github/workflows/) | Repository CI and reusable jobs with fixed permissions, trusted checkout, concurrency, and workload selection |
+| [.github/workflows/](.github/workflows/) | Repository CI and reusable jobs with fixed permissions, trusted checkout, concurrency, and task selection |
 | [.github/actions/setup-openshell/](.github/actions/setup-openshell/action.yml) | OpenShell installation and gateway readiness for the current local CI path |
 | [scripts/pr-review.sh](scripts/pr-review.sh) | Trusted review preparation and temporary workspace/provider bootstrap |
-| [workloads/](workloads/) | Task instructions, policy, provider references, image selection, payloads, and outputs |
-| [workflow/](workflow/) | Generic `plan`/`apply` composition and sandbox lifecycle |
+| [tasks/](tasks/) | Task instructions, policy, provider references, image selection, payloads, and outputs |
+| [runner/](runner/) | Generic `plan`/`apply` composition and sandbox lifecycle |
 | [images/](images/) | Reusable runtime toolchains |
 | Platform administration | Managed gateway access, workspace membership, provider credential lifecycle, and inference configuration |
 | OpenShell | Gateway resources, credential-backed proxies, inference routing, policy enforcement, and sandbox isolation |
@@ -231,7 +231,7 @@ and sandbox inspection.
 
 ## Documentation and validation
 
-- [workflow/](workflow/) — implementation and lifecycle of the `harness` CLI
+- [runner/](runner/) — implementation and lifecycle of the `harness` CLI
 - [docs/workflow-format.md](docs/workflow-format.md) — version 1 workflow contract
 - [docs/ci.md](docs/ci.md) — trusted CI setup and managed deployment requirements
 - [docs/compatibility.md](docs/compatibility.md) — tested dependency versions

docs/ci.md

@@ -100,7 +100,7 @@ comments only; they do not approve, request changes, or merge.
 The active reviewer runs OpenCode with Gemini 2.5 Pro through `inference.local`
 and Google Vertex AI. The model is selected in
 [`scripts/pr-review.sh`](../scripts/pr-review.sh) and
-[`opencode-harness.yaml`](../workloads/github-pr-reviewer/workflow/opencode-harness.yaml).
+[`opencode-harness.yaml`](../tasks/github-pr-reviewer/workflow/opencode-harness.yaml).
 Keep those selections aligned and verify model access with the CI identity
 when changing them.
 

docs/workflow-format.md

@@ -10,7 +10,7 @@ use Kubernetes-style `kind`, `apiVersion`, `metadata`, or `spec` wrappers.
 
 This illustrates the schema. Supply a usable image, existing providers, and
 the task's policy and payloads before applying it; see the
-[task bundles](../workloads/) for concrete inputs.
+[task bundles](../tasks/) for concrete inputs.
 
 ```yaml
 version: 1
@@ -68,7 +68,7 @@ optional. Unknown fields are rejected so a typo cannot silently change a run.
 Run a workflow with outputs by choosing an explicit host directory:
 
 ```bash
-harness workflow apply workflow.yaml --output-dir ./workflow-artifacts
+harness workflow apply workflow.yaml --output-dir ./runner-artifacts
 ```
 
 Downloads happen before the sandbox cleanup step, including when the agent
@@ -109,6 +109,6 @@ bootstrap-owned route; isolated workspaces may use the compatibility write.
 
 ## Compatibility policy
 
-The Go parser in `workflow/internal/config` is the executable source of truth. Parser,
+The Go parser in `runner/internal/config` is the executable source of truth. Parser,
 plan, apply, and redaction tests are the format contract. A future incompatible
 shape increments `version` and fails clearly; there is no migration layer.

images/README.md

@@ -8,7 +8,7 @@ A task bundle selects an image, and the `harness` CLI passes that image referenc
 to OpenShell when it creates the sandbox. Local and managed gateways use the
 same contract. Add a separate image only when a task needs a materially
 different system toolchain; otherwise reuse an existing image and keep
-task-specific behavior in `workloads/`.
+task-specific behavior in `tasks/`.
 
 StackRox image profiles and build instructions are documented in
 [`stackrox/README.md`](stackrox/README.md).

workflow/README.md → runner/README.md

@@ -1,4 +1,4 @@
-# Workflow runner
+# Runner
 
 This directory contains the Go implementation of the `harness` CLI, the small
 composition and sandbox lifecycle component of `harness-openshell`. A harness
@@ -37,10 +37,10 @@ The repository keeps `go.mod` at its root so the runner, integration tests, and
 repository tooling remain one Go module. Build the CLI with:
 
 ```bash
-go build -o harness ./workflow
+go build -o harness ./runner
 ```
 
-Task bundles remain under `workloads/`; they are inputs to this runner, not
+Task bundles remain under `tasks/`; they are inputs to this runner, not
 Go packages. Repository-level integration tests remain under `test/` because
 they exercise shell workflows and gateway lifecycle behavior rather than the
 runner packages themselves.

workflow/cmd/apply.go → runner/cmd/apply.go

@@ -4,7 +4,7 @@ import (
 	"fmt"
 
 	"github.com/spf13/cobra"
-	"github.com/stackrox/harness-openshell/workflow/internal/openshell"
+	"github.com/stackrox/harness-openshell/runner/internal/openshell"
 )
 
 func NewApplyCmd(newClient openshell.Factory) *cobra.Command {

workflow/cmd/apply_result.go → runner/cmd/apply_result.go

@@ -8,7 +8,7 @@ import (
 	"os"
 	"time"
 
-	"github.com/stackrox/harness-openshell/workflow/internal/source"
+	"github.com/stackrox/harness-openshell/runner/internal/source"
 )
 
 // applyResult deliberately excludes configuration, raw errors, and agent output:

workflow/cmd/apply_result_test.go → runner/cmd/apply_result_test.go

@@ -12,8 +12,8 @@ import (
 
 	fake "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/fake"
 	"github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/types"
-	"github.com/stackrox/harness-openshell/workflow/internal/openshell"
-	"github.com/stackrox/harness-openshell/workflow/internal/testutil"
+	"github.com/stackrox/harness-openshell/runner/internal/openshell"
+	"github.com/stackrox/harness-openshell/runner/internal/testutil"
 )
 
 type resultSDK struct {

workflow/cmd/apply_service.go → runner/cmd/apply_service.go

@@ -7,11 +7,11 @@ import (
 	"io"
 	"os"
 
-	"github.com/stackrox/harness-openshell/workflow/internal/openshell"
-	"github.com/stackrox/harness-openshell/workflow/internal/plan"
-	"github.com/stackrox/harness-openshell/workflow/internal/reconcile"
-	"github.com/stackrox/harness-openshell/workflow/internal/run"
-	"github.com/stackrox/harness-openshell/workflow/internal/status"
+	"github.com/stackrox/harness-openshell/runner/internal/openshell"
+	"github.com/stackrox/harness-openshell/runner/internal/plan"
+	"github.com/stackrox/harness-openshell/runner/internal/reconcile"
+	"github.com/stackrox/harness-openshell/runner/internal/run"
+	"github.com/stackrox/harness-openshell/runner/internal/status"
 )
 
 type applyRequest struct {

workflow/cmd/connect_plan.go → runner/cmd/connect_plan.go

@@ -6,8 +6,8 @@ import (
 	"fmt"
 	"io"
 
-	"github.com/stackrox/harness-openshell/workflow/internal/openshell"
-	"github.com/stackrox/harness-openshell/workflow/internal/plan"
+	"github.com/stackrox/harness-openshell/runner/internal/openshell"
+	"github.com/stackrox/harness-openshell/runner/internal/plan"
 )
 
 // connectAndBuildPlan uses the same target connection and offline fallback for

workflow/cmd/connect_plan_test.go → runner/cmd/connect_plan_test.go

@@ -7,10 +7,10 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/stackrox/harness-openshell/workflow/internal/config"
-	"github.com/stackrox/harness-openshell/workflow/internal/openshell"
-	"github.com/stackrox/harness-openshell/workflow/internal/plan"
-	"github.com/stackrox/harness-openshell/workflow/internal/testutil"
+	"github.com/stackrox/harness-openshell/runner/internal/config"
+	"github.com/stackrox/harness-openshell/runner/internal/openshell"
+	"github.com/stackrox/harness-openshell/runner/internal/plan"
+	"github.com/stackrox/harness-openshell/runner/internal/testutil"
 )
 
 func TestConnectAndBuildPlanOfflineKeepsProvidersUninspected(t *testing.T) {

workflow/cmd/plan.go → runner/cmd/plan.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 
 	"github.com/spf13/cobra"
-	"github.com/stackrox/harness-openshell/workflow/internal/openshell"
+	"github.com/stackrox/harness-openshell/runner/internal/openshell"
 )
 
 // NewPlanCmd constructs the "harness workflow plan" command.

workflow/cmd/plan_redaction.go → runner/cmd/plan_redaction.go

@@ -4,8 +4,8 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/stackrox/harness-openshell/workflow/internal/config"
-	"github.com/stackrox/harness-openshell/workflow/internal/plan"
+	"github.com/stackrox/harness-openshell/runner/internal/config"
+	"github.com/stackrox/harness-openshell/runner/internal/plan"
 )
 
 // redactedPlan returns a display-only copy of p. Planning and reconciliation

workflow/cmd/plan_test.go → runner/cmd/plan_test.go

@@ -10,9 +10,9 @@ import (
 
 	fake "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/fake"
 	"github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/types"
-	"github.com/stackrox/harness-openshell/workflow/internal/openshell"
-	"github.com/stackrox/harness-openshell/workflow/internal/plan"
-	"github.com/stackrox/harness-openshell/workflow/internal/testutil"
+	"github.com/stackrox/harness-openshell/runner/internal/openshell"
+	"github.com/stackrox/harness-openshell/runner/internal/plan"
+	"github.com/stackrox/harness-openshell/runner/internal/testutil"
 )
 
 // captureStdout runs fn and returns captured stdout.

workflow/cmd/sandbox_test.go → runner/cmd/sandbox_test.go

@@ -5,7 +5,7 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/stackrox/harness-openshell/workflow/internal/config"
+	"github.com/stackrox/harness-openshell/runner/internal/config"
 )
 
 func TestCanonicalRunRequestRejectsLocalImages(t *testing.T) {

workflow/cmd/target.go → runner/cmd/target.go

@@ -4,7 +4,7 @@ import (
 	"fmt"
 
 	"github.com/spf13/cobra"
-	"github.com/stackrox/harness-openshell/workflow/internal/openshell"
+	"github.com/stackrox/harness-openshell/runner/internal/openshell"
 )
 
 // registerTargetFlags adds the standard --gateway/--workspace flags to cmd and

workflow/cmd/workflow.go → runner/cmd/workflow.go

@@ -6,9 +6,9 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/stackrox/harness-openshell/workflow/internal/config"
-	"github.com/stackrox/harness-openshell/workflow/internal/openshell"
-	"github.com/stackrox/harness-openshell/workflow/internal/plan"
+	"github.com/stackrox/harness-openshell/runner/internal/config"
+	"github.com/stackrox/harness-openshell/runner/internal/openshell"
+	"github.com/stackrox/harness-openshell/runner/internal/plan"
 )
 
 // resolvedWorkflow is the single resolved input shared by plan and apply.

workflow/cmd/workflow_apply.go → runner/cmd/workflow_apply.go

@@ -8,12 +8,12 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/stackrox/harness-openshell/workflow/internal/config"
-	"github.com/stackrox/harness-openshell/workflow/internal/openshell"
-	"github.com/stackrox/harness-openshell/workflow/internal/plan"
-	"github.com/stackrox/harness-openshell/workflow/internal/run"
-	"github.com/stackrox/harness-openshell/workflow/internal/source"
-	"github.com/stackrox/harness-openshell/workflow/internal/status"
+	"github.com/stackrox/harness-openshell/runner/internal/config"
+	"github.com/stackrox/harness-openshell/runner/internal/openshell"
+	"github.com/stackrox/harness-openshell/runner/internal/plan"
+	"github.com/stackrox/harness-openshell/runner/internal/run"
+	"github.com/stackrox/harness-openshell/runner/internal/source"
+	"github.com/stackrox/harness-openshell/runner/internal/status"
 	"gopkg.in/yaml.v3"
 )
 

workflow/cmd/workflow_apply_test.go → runner/cmd/workflow_apply_test.go

@@ -11,9 +11,9 @@ import (
 
 	fake "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/fake"
 	"github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/types"
-	"github.com/stackrox/harness-openshell/workflow/internal/config"
-	"github.com/stackrox/harness-openshell/workflow/internal/openshell"
-	"github.com/stackrox/harness-openshell/workflow/internal/testutil"
+	"github.com/stackrox/harness-openshell/runner/internal/config"
+	"github.com/stackrox/harness-openshell/runner/internal/openshell"
+	"github.com/stackrox/harness-openshell/runner/internal/testutil"
 )
 
 func TestCanonicalWorkflowPlanAndApplyShareResolvedTarget(t *testing.T) {
@@ -700,7 +700,7 @@ func boolPtr(value bool) *bool { return &value }
 
 func TestGitHubReviewerCustomSkillUsesWorkflowPayloadPath(t *testing.T) {
 	dir := t.TempDir()
-	exampleDir := filepath.Join("..", "..", "workloads", "github-pr-reviewer", "workflow")
+	exampleDir := filepath.Join("..", "..", "tasks", "github-pr-reviewer", "workflow")
 	workflowPath := filepath.Join(dir, "opencode-harness.yaml")
 	workflowBytes, err := os.ReadFile(filepath.Join(exampleDir, "opencode-harness.yaml"))
 	if err != nil {

workflow/cmd/workflow_command.go → runner/cmd/workflow_command.go

@@ -2,7 +2,7 @@ package cmd
 
 import (
 	"github.com/spf13/cobra"
-	"github.com/stackrox/harness-openshell/workflow/internal/openshell"
+	"github.com/stackrox/harness-openshell/runner/internal/openshell"
 )
 
 // NewWorkflowCmd groups the commands that operate on repository workflows.

workflow/internal/openshell/sdkclient/auth.go → runner/internal/openshell/sdkclient/auth.go

@@ -7,7 +7,7 @@ import (
 	gw "github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/gateway"
 	"github.com/NVIDIA/OpenShell/sdk/go/openshell/v1/types"
 
-	"github.com/stackrox/harness-openshell/workflow/internal/openshell"
+	"github.com/stackrox/harness-openshell/runner/internal/openshell"
 )
 
 // connBranch represents the auth mode branch decision for connection setup.